terraform-example-foundation
terraform-example-foundation copied to clipboard
Allow deploying more than one instance of the LZ under an organization
TL;DR
If a deployment already completed under a folder, a 2'nd deployment under a different folder in the same organization will fail. Because some resources are deployed at the org level and their names are not suffix-randomized as is the case e.g. with project IDs. Deploying multiple instances, one by developer, is necessary for testing. When deploying 1-org in 2'nd deployment getting Error: Error creating NotificationConfig: googleapi: Error 409: Requested entity already exists
with google_scc_notification_config.scc_notification_config, on scc_notification.tf line 32, in resource "google_scc_notification_config" "scc_notification_config": 32: resource "google_scc_notification_config" "scc_notification_config" {
Error: Error waiting to create TagKey: Error waiting for Creating TagKey: Error code 6, message:
with google_tags_tag_key.tag_keys["environment"], on tags.tf line 56, in resource "google_tags_tag_key" "tag_keys": 56: resource "google_tags_tag_key" "tag_keys" {
Terraform Resources
Resources like "google_access_context_manager_access_policy" or "google_tags_tag_key" have as parent "organizations/${var.parent_id}"
In case Terraform supports as parent only the organization then give an option to randomize the resource names to avoid conflicts
Detailed design
Randomize the names using a suffix. Intent already in 1-org/envs/shared/tags.tf - just randomize values :
locals {
tags = {
environment = {
shortname = "environment${local.key_suffix}"
description = "Environment identification"
values = ["bootstrap", "production", "non-production", "development"]
}
...
key_suffix = var.create_unique_tag_key ? "-${random_string.tag_key_suffix.result}" : ""
}
resource "google_tags_tag_key" "tag_keys" {
for_each = local.tags
parent = "organizations/${local.org_id}"
short_name = each.value.shortname
description = each.value.description
}
Additional information
Similarly randomize resource name in 1-org/envs/shared/scc_notification.tf (right now hardcoded as below and defined at org level) resource "google_scc_notification_config" "scc_notification_config" { config_id = var.scc_notification_name organization = local.org_id